CVE-2026-66050 is a path traversal vulnerability in NitroShare Desktop (<=0.3.4) affecting its LAN file transfer server. The vulnerability arises from improper validation of filenames in the JSON header name field, allowing attackers on the local network to write files outside the designated transfer root directory. This can be exploited to place files in arbitrary writable locations accessible by the current user, including the Windows Startup folder, potentially enabling persistent code execution. The vulnerability requires no authentication and has a CVSS v4.0 base score of 8.7, indicating high severity. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

An unauthenticated attacker on the same network can write arbitrary files to locations outside the intended directory, including sensitive system folders such as the Windows Startup folder. This can lead to persistent code execution when the user logs in, posing a significant security risk. The vulnerability compromises system integrity and persistence without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the LAN file transfer server or restricting network access to trusted hosts to mitigate the risk of exploitation.